njrat | 3243f9b754342412b3dfdcdb6b3dabeea1388ee94ee32af129ceec5d8097799b

Analysis

max time kernel
149s
max time network
152s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
10/05/2024, 05:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

86a9fd7269d1fadb204a7612df599e50_NeikiAnalytics.exe
Size

113KB
MD5

86a9fd7269d1fadb204a7612df599e50
SHA1

7e404cb4f315312d6f37b61c46f2e54ddb038728
SHA256

3243f9b754342412b3dfdcdb6b3dabeea1388ee94ee32af129ceec5d8097799b
SHA512

02d7625060a1fb7c3751e66177633818a490b932744f4551b9543eb599ff92c1d2b1e3133dee87a1bba548227b66a4bd5059523a7c7fc3d95a3f5792d8df5c31
SSDEEP

1536:WWp5eznKUlIOp3YjVCguHEvQEbFqVC3woFRKpT4XEQhuxzuMiatS:P5eznsjsguGDFqGZ2ra

Score

10^/10

njrat neuf evasion persistence trojan

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

neuf

doddyfire.linkpc.net:10000

Mutex

e1a87040f2026369a233f9ae76301b7b

Attributes

reg_key
e1a87040f2026369a233f9ae76301b7b
splitter
|'|'|

Signatures

njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat

Modifies Windows Firewall 2 TTPs 1 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
2472	netsh.exe

Executes dropped EXE 2 IoCs

pid	Process
2716	chargeable.exe
2660	chargeable.exe

Loads dropped DLL 2 IoCs

pid	Process
2700	86a9fd7269d1fadb204a7612df599e50_NeikiAnalytics.exe
2700	86a9fd7269d1fadb204a7612df599e50_NeikiAnalytics.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Run\confuse = "C:\\Users\\Admin\\AppData\\Roaming\\confuse\\chargeable.exe"	86a9fd7269d1fadb204a7612df599e50_NeikiAnalytics.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Run\SysMain = "C:\\Users\\Admin\\AppData\\Local\\Temp\\86a9fd7269d1fadb204a7612df599e50_NeikiAnalytics.exe"	86a9fd7269d1fadb204a7612df599e50_NeikiAnalytics.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2716 set thread context of 2660	2716	chargeable.exe	29

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 31 IoCs

description	pid	Process
Token: SeDebugPrivilege	2660	chargeable.exe
Token: 33	2660	chargeable.exe
Token: SeIncBasePriorityPrivilege	2660	chargeable.exe
Token: 33	2660	chargeable.exe
Token: SeIncBasePriorityPrivilege	2660	chargeable.exe
Token: 33	2660	chargeable.exe
Token: SeIncBasePriorityPrivilege	2660	chargeable.exe
Token: 33	2660	chargeable.exe
Token: SeIncBasePriorityPrivilege	2660	chargeable.exe
Token: 33	2660	chargeable.exe
Token: SeIncBasePriorityPrivilege	2660	chargeable.exe
Token: 33	2660	chargeable.exe
Token: SeIncBasePriorityPrivilege	2660	chargeable.exe
Token: 33	2660	chargeable.exe
Token: SeIncBasePriorityPrivilege	2660	chargeable.exe
Token: 33	2660	chargeable.exe
Token: SeIncBasePriorityPrivilege	2660	chargeable.exe
Token: 33	2660	chargeable.exe
Token: SeIncBasePriorityPrivilege	2660	chargeable.exe
Token: 33	2660	chargeable.exe
Token: SeIncBasePriorityPrivilege	2660	chargeable.exe
Token: 33	2660	chargeable.exe
Token: SeIncBasePriorityPrivilege	2660	chargeable.exe
Token: 33	2660	chargeable.exe
Token: SeIncBasePriorityPrivilege	2660	chargeable.exe
Token: 33	2660	chargeable.exe
Token: SeIncBasePriorityPrivilege	2660	chargeable.exe
Token: 33	2660	chargeable.exe
Token: SeIncBasePriorityPrivilege	2660	chargeable.exe
Token: 33	2660	chargeable.exe
Token: SeIncBasePriorityPrivilege	2660	chargeable.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 2700 wrote to memory of 2716	2700	86a9fd7269d1fadb204a7612df599e50_NeikiAnalytics.exe	28
PID 2700 wrote to memory of 2716	2700	86a9fd7269d1fadb204a7612df599e50_NeikiAnalytics.exe	28
PID 2700 wrote to memory of 2716	2700	86a9fd7269d1fadb204a7612df599e50_NeikiAnalytics.exe	28
PID 2700 wrote to memory of 2716	2700	86a9fd7269d1fadb204a7612df599e50_NeikiAnalytics.exe	28
PID 2716 wrote to memory of 2660	2716	chargeable.exe	29
PID 2716 wrote to memory of 2660	2716	chargeable.exe	29
PID 2716 wrote to memory of 2660	2716	chargeable.exe	29
PID 2716 wrote to memory of 2660	2716	chargeable.exe	29
PID 2716 wrote to memory of 2660	2716	chargeable.exe	29
PID 2716 wrote to memory of 2660	2716	chargeable.exe	29
PID 2716 wrote to memory of 2660	2716	chargeable.exe	29
PID 2716 wrote to memory of 2660	2716	chargeable.exe	29
PID 2716 wrote to memory of 2660	2716	chargeable.exe	29
PID 2660 wrote to memory of 2472	2660	chargeable.exe	30
PID 2660 wrote to memory of 2472	2660	chargeable.exe	30
PID 2660 wrote to memory of 2472	2660	chargeable.exe	30
PID 2660 wrote to memory of 2472	2660	chargeable.exe	30

C:\Users\Admin\AppData\Local\Temp\86a9fd7269d1fadb204a7612df599e50_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\86a9fd7269d1fadb204a7612df599e50_NeikiAnalytics.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2700
- C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe
  "C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:2716
- - C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe
    C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2660
  - - C:\Windows\SysWOW64\netsh.exe
      netsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe" "chargeable.exe" ENABLE
      4⤵
      Modifies Windows Firewall
      PID:2472

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\37C951188967C8EB88D99893D9D191FE

Filesize
1KB

MD5
cba2426f2aafe31899569ace05e89796

SHA1
3bfb16faefd762b18f033cb2de6ceb77db9d2390

SHA256
a465febe8a024e3cdb548a3731b2ea60c7b2919e941a24b9a42890b2b039b85a

SHA512
395cce81a7966f02c49129586815b833c8acfe6efbb8795e56548f32819270c654074622b7fa880121ce7fbd29725af6f69f89b8c7e02c64d1bbffbfe0620c68

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C0018BB1B5834735BFA60CD063B31956

Filesize
1KB

MD5
0376ba21bc7c1d09e61b206c11bbc92c

SHA1
443fee1cb47f3497f1e8042a94c5da8655aa7cd7

SHA256
1e377d5df77b88b5dd8cde349ceb5c939eaddb2af2676ec91346f9ef7e24a0ab

SHA512
f68db4ce81924b2531b3467a23e02b2913086b6293d0d5a81fe9dbee941504502ea590d4667e3e758f3b4986384200700cb919bc7a5b75a29080e66b29aa9e23

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\37C951188967C8EB88D99893D9D191FE

Filesize
264B

MD5
fe386adeead055e10086bf16faf83b6d

SHA1
ad4d92507c74da46561333355f666e0668bc5e04

SHA256
f75444d84cb92857176d006beaaa22a6575464d87d3d1d011eb3c836bb4ff9bf

SHA512
124a7fe975692396df5fdc36b385434630624a968b8b089cbce07dfe9cb99ea9873e0362dad4a63bd8d9f3caea5b87f3c78f85b2d3dc4d287ed61d1c6d78440a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
77851e46dd3abaf570e82650dc3e2886

SHA1
47697d708d99f886e196c6b852d6dc7df1e39746

SHA256
16e2f444b022d52e05805e168ab66861fa01a2271497fbcf3fe39aad76f23297

SHA512
45fc3e25f09c1694c33585ede6fe1fc2779b83ea9f5495a6e45f45cae4d47d19da85c20f01e034240a222c83ecb99312ccaaaa88d2d4e1ba2fcc32771b446d31

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5075a7f5f60917a8085cf3cb5d4e3edf

SHA1
c0d7ad2e4669d96606e10d451650e60e71e3ba75

SHA256
c39b8d8523f975d941e414bf8ecb987de5718936992f48194efc0bc4246bb02b

SHA512
46c5e178219fc5784a4c427e476688443a79a018b1a6125da260c9e0789e1c8d97bc33ff9f20378fcdd58c7515951fb310f34e0ac86ec28d31490607460c335e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d34267535ca46a732d5db931235d9d4f

SHA1
4d5422446e897c655668203476480a0722ac15ce

SHA256
f5048e19e1d4baa5fe0a169b22c5471f80fafb348767a524d19804b711f1b9d6

SHA512
382407e0ae7dcdbd5d1c5ab44d00c5818082d47d719e176ce508bda4cf85e16bde569f773dd52a1ec8d48fe370c193c84d46fb28a97d999a5c42b34be702b9a1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C0018BB1B5834735BFA60CD063B31956

Filesize
252B

MD5
17eefcc6e870d5e8f679ea9a14d507bb

SHA1
822c00639e96726ccdbb78fe875af8c36c65e384

SHA256
77e58ef5f924d3caaaf49e8a06e3e223fbd2df773d16e194ec69816d85201dba

SHA512
0c82a6c1782bc5785903d1ce4858cded477ed5c031ba5fe24bb3862ea52882810baa9eac298f1a10381195f42cb31b54fddaecb6ca9280627d289e99f0711e10

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab8558.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar8599.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar88FD.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit
\Users\Admin\AppData\Roaming\confuse\chargeable.exe

Filesize
113KB

MD5
1691667f24a8741effd8ee52b95f4f2f

SHA1
2c7f5d1d91f83e66ad7ee7983b7d7693474fe2ba

SHA256
682b9a95d1779124d06b84f83accd1f3040377af72034cff482409d13cf8294c

SHA512
f8a0833010df8dfb3f7bd7f471efc021085bf5c7272fda472f197366c1d6140f41072730cf1a0522cfdb95dbfe0e11094d15636d6f8d2a2d21ca0eb5a6e684f0

Download Submit
memory/2660-366-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/2660-368-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/2660-369-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/2700-197-0x0000000074C60000-0x000000007520B000-memory.dmp

Filesize
5.7MB

Download
memory/2700-0-0x0000000074C61000-0x0000000074C62000-memory.dmp

Filesize
4KB

Download
memory/2700-9-0x0000000074C60000-0x000000007520B000-memory.dmp

Filesize
5.7MB

Download
memory/2700-1-0x0000000074C60000-0x000000007520B000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads